Inability to de-op players if listed in ops.txt with non-lowercase letters
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub.
Summary
### Impact Originally reported in iTXTech/Genisys#1188 ```txt PotterHarry98 potterharry98 ``` `deop PotterHarry98` will remove `potterharry98` from the ops.txt but not `PotterHarry98`. Operator permissions are checked using `Config->exists()` with `lowercase=true`, which will result in a match: https://github.com/pmmp/PocketMine-MP/blob/22bb1ce8e03dba57173debf0415390511d68e045/src/utils/Config.php#L449 This means that it's possible to make yourself impossible to de-op (using commands) by adding your name to ops.txt with uppercase letters. ### Patches 4d37b79ff7f9d9452e988387f97919a9a1c4954e ### Workarounds This can be easily addressed by removing the offending lines from ops.txt manually. ### For more information If you have any questions or comments about this advisory: * Open an issue in [pmmp/PocketMine-MP](https://github.com/pmmp/PocketMine-MP) * Email us at [[email protected]](mailto:[email protected])
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | pocketmine/pocketmine-mp (Packagist) | before 4.0.3 | 4.0.3 | Patch available | GHSA-j5qg-w9jg-3wg3 |
- pocketmine/pocketmine-mp (Packagist) Vendor— Affected before 4.0.3 Fixed in 4.0.3 Patch available GHSA-j5qg-w9jg-3wg3
Remediation
- Fix · GHSA-j5qg-w9jg-3wg3 pocketmine/pocketmine-mp (Packagist) Fixed in 4.0.3 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-j5qg-w9jg-3wg3
References
Other 5
- https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-j5qg-w9jg-3wg3
- https://github.com/iTXTech/Genisys/issues/1188
- https://github.com/pmmp/PocketMine-MP/commit/4d37b79ff7f9d9452e988387f97919a9a1c4954e
- https://github.com/pmmp/PocketMine-MP
- https://github.com/pmmp/PocketMine-MP/blob/4.0.3/changelogs/4.0.md#403
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences